Cybersecurity

Brussels Assumes You Test Every Three Years

Horizon3 raised 250 million dollars at over 2 billion on the premise that penetration testing is continuous. European financial rules require a threat-led test every three years.

CybersecurityBy Servola Tech Desk2026-08-035 min read

AI-assisted, edited by humans. | Editor-in-Chief: Leon Soliman | Editorial standards

Key takeaways

Horizon3 has raised a 250 million dollar Series E at a valuation above 2 billion dollars, roughly tripling a valuation of about 650 million from a little over a year ago, on the premise that penetration testing has to run continuously rather than as a scheduled event.
European rules point the other way. Articles 26 and 27 of the Digital Operational Resilience Act require identified financial entities to carry out threat-led penetration testing at least every three years, and the TIBER-EU framework was updated on 11 February 2025 to align with the technical standards behind it.
For a firm in scope since DORA began applying in January 2025, a three-year cycle puts the first full test around January 2028, which is roughly eighteen months away. Nothing in that cadence tells you what happened to your exposure in the intervening thousand days.
Financial entities follow DORA and not NIS2, because Article 4 of NIS2 defers to it as the more specific law. Check which regime binds you before you budget a testing programme, since firms often assume the wrong one.
Separate the compliance artefact from the control this cycle. Keep the three-yearly threat-led test as the regulated deliverable, and add continuous or quarterly testing as the thing that actually tracks exposure between those dates.

A 250 million dollar bet that testing is not an event

Snehal Antani, who founded Horizon3 in 2019 with Anthony Pillitiere after both worked at Joint Special Operations Command, described the milestone in terms of earned permission rather than technology. The company invented the concept of AI hackers, he said, and spent six years earning the right to autonomously test the most critical networks. On 3 August the company announced a 250 million dollar Series E at a valuation above 2 billion dollars, co-led by returning investors NightDragon and NEA, with Acrew, Blue Cloud Ventures, EDBI, Demeter Group, PSG, SAIC and Sapphire joining, alongside existing backers including Craft Ventures, Prosperity7 Ventures, Qualcomm Ventures, Ridge Ventures and SignalFire.

The numbers behind the round describe a category being repriced rather than a single company doing well. Horizon3 reports annual recurring revenue approaching 100 million dollars with growth of 120 percent year on year, more than 7,000 organisations protected, four Fortune 10 enterprises as customers, and 310,000 tests run inside live production environments. Dave DeWalt, who founded NightDragon and previously ran FireEye and McAfee, joins the board along with NightDragon managing director Morgan Kyauk. The company opened an Amsterdam office in June and is extending into Australia and Singapore.

What European law actually requires, and how often

The Digital Operational Resilience Act sets the cadence for the firms most likely to buy this product. Articles 26 and 27 require identified financial entities to carry out advanced resilience testing by means of threat-led penetration testing at least every three years. Only entities considered significant, with sufficiently mature systems, fall into that obligation, and the standards for it were developed in line with the TIBER-EU framework, which was updated on 11 February 2025 to match the regulatory technical standards adopted under DORA.

Two details are worth fixing in your head before any budget conversation. First, financial entities are governed by DORA rather than NIS2, because Article 4 of NIS2 defers to the more specific regime, and firms regularly plan against the wrong one. Second, the cadence is a floor rather than a target. DORA began applying in January 2025, so a three-year cycle places the first complete threat-led test around January 2028 for entities in scope from the start, which is roughly eighteen months from now. The United Kingdom runs its own threat-led scheme for major firms on a comparable philosophy.

The artefact and the control are drifting apart

Here is the tension the funding round exposes. A threat-led penetration test is intelligence-driven, run by skilled humans against a scoped target, and it produces a document that satisfies a supervisor. Continuous automated testing produces something different: a rolling measurement of exploitable exposure. Horizon3's chief revenue officer Matt Hartley argues that a conventional engagement examines only two or three percent of a network once a year, while an autonomous platform can cover the whole estate continuously without taking production offline. That is a vendor's framing of a vendor's advantage and should be read as such, but the underlying observation about sampling is not controversial among people who commission these tests.

The honest counterweight is that automation does not replace what makes a threat-led test valuable. TLPT is built on threat intelligence about who would plausibly attack this specific institution and how, and a good red team invents attack paths no scanner enumerates. The two things are not substitutes, and a firm that cancels its human red team because it bought an autonomous platform has misread both. What is genuinely changing is the meaning of the three-year certificate. Passing in 2028 says the estate withstood a scoped, intelligence-led attack on one set of dates. It says nothing about the thousand days on either side, and the market has just put 250 million dollars behind the view that those days are where the exposure lives.

What to change in the next testing cycle

Start by writing down which regime binds you and on what date your next threat-led test is due. That sounds elementary, and it is the step most often skipped, because responsibility for the answer usually sits between a compliance function that knows the deadline and a security function that knows the estate. If your firm is in scope and DORA applied to you from January 2025, work backwards from early 2028 and note that scoping and threat intelligence work begins many months before the test itself.

Then treat the two activities as separate line items with separate purposes. The regulated test is a deliverable with a date, a scope agreed with a supervisor and an intelligence phase, and it should be budgeted as a project. Continuous testing is an operational control, and the question to ask a vendor is not how many findings it produces but how quickly a newly exposed asset appears in its results and how it behaves against live production. Ask for the failure record too, not just the count of tests run without disruption. A platform that has executed hundreds of thousands of production tests has a safety story worth examining in detail before it touches your core banking estate.

Frequently asked questions

Does an autonomous testing platform satisfy the DORA threat-led requirement?

No. Threat-led penetration testing under Articles 26 and 27 has prescribed characteristics, including threat intelligence tailored to the entity and a process aligned with the TIBER-EU framework. An autonomous platform is a control that runs between those tests, not a substitute for the regulated exercise itself.

We are not a financial entity. Does any of this apply to us?

The three-year threat-led obligation does not, but the underlying logic does. Most firms outside financial services test on an annual or ad hoc basis, which leaves the same measurement gap between engagements. The useful question is not what your regulator demands but how long an exploitable exposure can sit in your estate before anyone would notice.

Is a valuation tripling in a year a reason to be cautious about the vendor?

It is a reason to ask about durability rather than to walk away. Revenue growth of 120 percent and a customer base above 7,000 organisations are real operating numbers, not just a funding headline. The relevant diligence is contractual: pricing protection at renewal, data handling during tests, and what happens to your deployment if the company is acquired.

The round will be reported as artificial intelligence fighting artificial intelligence, because that is the phrase the market rewards. The more useful reading is duller and closer to home. European law fixed a three-year rhythm for testing the firms that matter most, the market has now priced a continuous alternative at over 2 billion dollars, and the gap between those two cadences is measured in days during which nobody is looking. Budget for both, and stop treating the certificate as the control.

Horizon3NodeZeroDORATIBER-EUPenetration testingNightDragonAutonomous security

Anthropic Won in March and Is Still Being Removed

A federal judge said the case against Anthropic has gotten worse for the government. The Pentagon phase-out still completes on 30 September.

4 min read

Infrastructure

Your DR Plan Assumes the Region Comes Back

AWS estimated at least a day to restore its UAE region after drone strikes in March. On 30 April it said the region could not reliably support applications.

5 min read

Law & Regulation

The EA Buyout Now Hinges on Brussels

The largest take-private in history has cleared EA shareholders and US antitrust. The last real gate is the EU - and not classic merger review, but the Foreign Subsidies Regulation, facing its first blockbuster test.

3 min read

← All articles